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Introduction 

Accidents hardly ever happen without warning. The combination, or sequence, of failures and 
mistakes that cause an accident may indeed be unique but the individual failures and mistakes rarely 
are. In the USA in 1974 the crews on two different aircraft misunderstood the same aeronautical 
chart and descended towards their destination dangerously early towards a mountain. The first 
crew were in good weather conditions and could see the mountain and resolved their 
misinterpretation of the chart. The second crew six weeks later were not so lucky. In cloud they 
had no clues to point out their mistake nor the presence of the mountain. The resulting crash and 
the ensuing inquiry, which brought to light the previous incident, shocked the country but gave it 
the impetus to instigate a safety reporting system. This system eventually became the NASA s 
Aviation Safety Reporting System (ASRS). The programme collects incident reports from pilots, 
controllers, mechanics, cabin attendants and many others involved in aviation operations. By 
disseminating this safety information the ASRS has helped enormously to give US airlines and 
airspace the highest safety standards. 

Accident prevention is a goal sought by everyone in the aviation industry and establishing effective 
incident reporting programmes can go a long way toward achieving that goal. This article will 
describe the steps and issues required to establish an incident reporting system. The authors 
summarize the lessons learned from the ASRS, now in its twentieth year of operation and from the 
Confidential Human Factors Reporting (HFR) Programme run by British Airways, an airline that 
is a recognized world leader in safety reporting and analysis. The differences between government 
and airline operation of confidential safety reporting systems will be addressed. 

Some traditional approaches to aviation accidents rely on the discovery of 'Pilot Error’ as the 
principle means of specifying the cause of an accident. More recent understanding has made us 
realise that safety procedures and defenses can also fail, often provoking the pilot into making the 
final error in the failure sequence. However, as the previous example shows the sequence is not 
always complete and an incident, not an accident, occurs. This gives us a great opportunity to 
discover the cause of the incident and error. With the benefit of the candid introspection of the 
individuals involved, voluntary confidential reporting systems have successfully captured human 
errors and with corrective action, blocked the sequence of events and prevented accidents. 


Encouraging Reporting 

Trust . For any incident reporting programme to be effective in uncovering the failures which 
make up an incident, the trust of the reporting community is paramount. This is even more 


important when candid disclosure of the reporter's own error(s) and their (possibly personal) 
causes is requested. Without that trust the report will be selective and will probably gloss over the 
pivotal human factors information. In the worst case, where potential reporters have no trust in the 
safety organisation, there may be no reporting at all. 


Confidentiality . One of the essential foundation stones of trust is confidentiality. Indeed, in the 
authors experience the only effective way to solicit information on the human factors involved in 
an incident is by providing confidentiality to the reporters. (See, for instance, O'Leary, 1995 ). 

The reporter must be confident that their own identity as well as their colleagues' is protected and 
that they will be indemnified against disciplinary proceedings that could be instituted in response to 
their report. A successful system is built on the knowledge that valid feedback on the reporter's or 
the systems failures is far more important than the allocation of blame. 

Anonymity . The easiest way to ensure confidentiality is to have the reporters submit 
anonymously. In some cultures this may be the only way a reporter will provide the in-depth 
human factors information about what they did wrong and how an accident can be prevented. The 
drawback to anonymous reporting is that if the analyst, when reading the report, needs clarification 
they cannot contact the reporter to resolve their questions. Moreover, it is easy for unenthusiastic 
managers to dismiss anonymous reporters as troublemakers. A final point against anonymous 
reporting is that in small airline operations it is practically impossible to offer anonymity. 

Experience has shown that the best approach is to have the reporting system deidentify the report. 
However, the deidentification process must be well defined and known to all potential reporters. 
Complete deidentification includes removing all people's names, the date, the time, the flight 
number, and the airline name. Since trends in incidents are of interest, a reporting system may 
wish to keep the month of the incident. Those studying fatigue may want to know if the incident 
occurred during the day or night. In areas with many operations, this information can also be 
retained without identifying the airline. In locations where there is only one operator of a particular 
type of aircraft, either the aircraft type or the location must be removed. The nature of the report 
will determine which is most important to be retained. 

Another way in which trust can be engendered in the reporting system is to separate the 
organisation receiving the incident reports from the authorities and the organisation employing the 
reporters. Preferably, as in the case of NASA and the ASRS, the system organiser has no legal 
authority over its reporters, be they pilot, controller, or mechanic. Reporting systems run by other 
research institutions such as universities also provide a disinterested third party who can earn the 
trust of the reporters. The trust can also come from the oversight of an advisory group that 
represents the interests of the reporters. The NASA ASRS has an advisory group composed of 
union representatives for the reporters. For example the unions have the responsibility to advise 
NASA regarding the deidentification and the release of information to other organisations and the 
media. 

If the reporting system is internal to an airline, then it is almost essential that the reporting system is 
situated in a department separate from those which control the pilots, cabin attendants, or engineers 
who might submit the reports. For instance, in British Airways the confidential HFR programme 
for flight crew is based in the Safety Services department which is completely independent of the 
Flight Operations department, thus providing the confidentiality assurance the reporters need to 
submit an incident report. 

It is important to note that trust may not come quickly. Individuals may be hesitant to report until 
the reporting system has proven itself to be sensitive to reporters concerns. As stated above, trust 
is the most important foundation of a successful reporting programme and it must be actively 
protected, even after many years of successful operation. A single case of a reporter being 



disciplined as a result of their report could destroy that trust and result in a total cessation of the 
fding of meaningful reports. 

Enticement . The second most important ingredient, after trust, is enticement to report. The 
reporters need to see a value in reporting. Naturally, the main value is that the aircraft they fly or 
maintain, or the air traffic they control, will be safer. The reporters need to know how their reports 
will be used to improve safety. One way to accomplish this is to provide feedback to the reporting 
community. Many reporting systems have newsletters that describe safety issues and highlight 
improvements that have resulted from reports being submitted. Thus both informing the reporters 
and giving them a pat on the back at the same time. Furthermore, it is human nature to be 
interested in accidents and incidents. Reports are very useful for communicating and encouraging 
safe practice. 

An important and proven technique for encouraging reporting, as used by the ASRS, is to provide 
a reporter with immunity from certificate action for a reported incident. The amount of reports 
received by that system averages 32,000 reports per year. Similar systems in other countries 
receive far fewer reports although it is true that other countries' authorities are less likely to apply 
legal or financial sanctions against errant aviators. Nevertheless, the offer of reporter immunity is 
probably the best enticement available and should be considered as a viable way to improve 
reporting rates and therefore, of course, safety. 

Ease of reporting is another important issue to consider when developing an incident reporting 
system. Pilots, controllers, mechanics, cabin attendants and other aviators are busy people. If the 
system allows them to report privately and easily, they are more likely to do so. Paper forms that 
can be filled out anywhere and mailed confidentially have proved to work well for airline and 
national systems. Electronic submission is desirable since the report can then more easily be 
entered into a database although various cultures around the world will respond differently to this 
opportunity. Care must also be taken to protect reporter identity and the information when 
electronic submission is used. 

Ease of use is also greatly affected by the design of the reporting form. If a form is long and 
requires a great deal of time to complete, the reporters are less likely to make the required effort. If 
the form is too short, it is difficult to obtain all the necessary information about the incident. In 
general the more specific the questions the easier it is to complete the questionnaire but the retrieved 
information will be limited by the choice of questions. More open questions about the reporter's 
perceptions, judgments, decisions and actions are not subject to this limitation and give the reporter 
greater chance to tell his or her full story. The latter is more effective in gathering all the 
information about an incident but takes longer to complete and usually needs more analytic 
resources within the reporting system. The use of such open questionnaires is probably best 
confined to situations where there exists an enthusiastic reporting population. When developing 
any form, the authors suggest a trial is made with the potential users to determine the acceptability 
and ease of use. 


Turning Incident Reports into Safety Actions 

Report processing . Once reports are received there are several steps required to turn those 
reports into valuable safety information that can be acted upon. The first step is to have the report 
analysed by an expert to determine the appropriate action to be taken, if any. A time-critical report 
may receive priority handling and such a report may result in an immediate alert to warn those 
involved of the hazard. The crash referred to above would almost certainly have been avoided had 
such a national system been in place in 1974. 



Alternatively, a report can be placed with similar reports and become the basis of a study or simply 
go directly into the database and be available for future analyses. Analysis can range from simple 
counts of incident types to causal linking that allows an organisation to look at specific internal 
weaknesses. A discussion of analysis and research techniques using incident data is beyond the 
scope of this paper. See Chappell, 1994 and O'Leary, 1995 for a description of how to use 
incident data to conduct human factors evaluations. 

It is essential that the analyst has in-depth knowledge of flight, air traffic, or maintenance 
operations. If the operating rules allow, there is an advantage if the analyst contacts the reporter, 
'callback', to get further clarification on the incident. An internal airline programme benefits 
greatly if analysts are respected and well-known peers of the reporters but of course this is not 
feasible with national reporting systems. After callback and analysis is complete the report should 
be deidentified before it is entered in the database. 

Incident database . The design of the database should permit easy data entry and data retrieval 
but the design of the questionnaire puts constraints on how reports in the database are subsequently 
searched. In the simplest form of questionnaire, the highly specific questions allow very simple 
response categorisation and database searching. Conversely, the 'open' questionnaires may 
require sophisticated text search capability built into the database (now available at low cost). 
Alternatively, the analysis can encode the reports with a set of standardised 'keywords' or 'factors' 
which will allow rapid searching through the database for all reports having some common factor. 
Care should be taken in the design of the database to allow flexibility, since undoubtedly the data 
will be used in ways that were never envisioned by the original designers. 

Solving safety problems . Once a safety problem has been identified by the incident reports, 
the solution must be determined. Reporting systems are usually independent of the organisation 
that is charged with enforcing procedures and setting policy. This is necessary to obtain the trust 
of the reporters, as mentioned above. Therefore, the role of the incident reporting system is usually 
one of creating an awareness of the safety problem on the part of those individuals who have the 
power to make changes in a system or an organisation's operations. Depending on whether the 
system is national or local, these individuals may be part of the Civil Aviation Authority, or they 
may direct the flight operations of an airline. Often one report is sufficient to persuade those 
responsible to affect a solution. Sometimes however, a study is required of the incident data to 
uncover the extent of the problem and recommend appropriate action. 


Airline Systems versus National Systems 

There are advantages and disadvantages to the reporting system being operated by the airline 
versus by the nation. The airline can identify and resolve internal issues directly. This is an 
efficient and powerful approach to safety. The disadvantage is that the airline does not have the 
information from other carriers and may not be aware of critical safety issues. Such was the case 
in the tragic accident mentioned above. Conversely, the national system can address a broader 
array of safety issues, due to the availability of incident reports from more sources. Issues such as 
a procedure or condition at a specific airport, and problems with a specific aircraft type can be more 
easily addressed by the national system. However, as the airline is deidentified in the national 
database, the information is less useful to those at the air carrier who are in a position to fix internal 
problems. An apparently successful approach to this problem is the recently introduced British 
Airways programme, Safety Information Exchange. In this programme, a group of cooperating 
airlines share partly deidentified data in a common database. 

The best approach is to have reporting systems both at the local (airline, air traffic facility, etc.) and 
national levels with the local sources feeding the national system. At an even more coordinated 



level, the national voluntary incident reporting systems around the world belong to an organisation 
that shares safety information on a global level. Safety issues arise at all these levels and each 
offers a unique perspective to solving those issues. 


The Bottom Line 


The financial and personnel requirements to operate an incident reporting system are minimal, 
although in these highly cost-conscious days they are never trivial. Capital costs have also been 
reduced dramatically with the continuing decrease in computer software and hardware system 
prices. However, the major resource required for a safety reporting system is the enthusiasm of 
the few knowledgeable pilots, controllers, and others who analyse the reports and run the system. 
Enthusiasm can be nurtured but not bought. 


Further Information 

Readers are encouraged to contact the NASA ASRS and British Airways for more information 
about developing an incident reporting system. The ASRS address is P.O. Box 189, Moffett 
Field, CA 94035-9800 USA. For a thorough description of the development and workings of the 
ASRS, see Reynard, Billings, Cheaney, and Hardy, 1986. The address for British Airways is: 
Safety Services, Human Factors Programme, Unit 3, Hatton Cross (S 599), P.O. Box 10, 
Heathrow Airport TW6 2JA U.K. 
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